<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements.  See the NOTICE file
distributed with this work for additional information
regarding copyright ownership.  The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License.  You may obtain a copy of the License at

  http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied.  See the License for the
specific language governing permissions and limitations
under the License.
-->

<html>
  <head>
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>mod_pagespeed and ngx_pagespeed Security Advisory: SSL fetching man-in-the-middle attack.</title>
    <link rel="stylesheet" href="doc.css">
  </head>
  <body>
<!--#include virtual="_header.html" -->


  <div id=content>
<h1>mod_pagespeed and ngx_pagespeed Security Advisory: SSL fetching man-in-the-middle attack.</h1>
<dl>
  <dt>Disclosed:</dt>
    <dd><p>June 17th, 2014</p></dd>
  <dt>Versions Affected:</dt>
    <dd>
      <ul>
        <li>mod_pagespeed 1.7.30.1 through 1.7.30.4 (fixed in 1.7.30.5)</li>
        <li>mod_pagespeed and ngx_pagespeed 1.8.31.1 through 1.8.31.3 (fixed in 1.8.31.4)</li>
      </ul>
    </dd>
  <dt>Summary:</dt>
    <dd><p>Some versions of mod_pagespeed and ngx_pagespeed, in order to
        support fetching of HTTPS content, link in versions of OpenSSL
        that are vulnerable to a man-in-the-middle attack. This attack permits
        an adversary that can monitor and alter traffic between a client
        (mod_pagespeed or ngx_pagespeed in this case) and a server to decrypt
        and modify encrypted transfers, as long as both are running vulnerable
        versions (see <a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0224">
        CVE-2014-0224</a> for more detail).
        </p>
        <p>
        mod_pagespeed and ngx_pagespeed users are only vulnerable if they turn
        on the optional <code>FetchHttps</code> feature.
        </p></dd>
  <dt>Solution:</dt>
    <dd><p>For mod_pagespeed, update to one of versions 1.7.30.5-stable,
    1.8.31.4-beta or newer.</p>

    <p>For ngx_pagespeed, update to 1.8.31.4-beta or newer.</p>
    </dd>
  <dt>Workaround:</dt>
    <dd>
    <p>Use a method other than <code>FetchHttps</code> to fetch https content,
       as described in <a href="https_support">HTTP Support</a> documentation.
    </p>
    </dd>
  </div>
  <!--#include virtual="_footer.html" -->
  </body>
</html>
